Inclusion of the "user" field in a modification

[jricher]

§5.3 Modifying an Existing Request: Editor's note:

This would allow the client to do things like gather the user's identifiers post-request, or gather an assertion from an on-device element that the AS can verify. It opens up potential avenues for trouble if the user here is different from the RO that's already showed up at the AS or race conditions if the RQ's identity changes mid-stream. But that said, this seems important for multi-log-in cases and the like, probably.

[fimbault]

We could include a warning, saying that the AS should check that it is indeed the same user, typically through validating the sub_id

[yaronf]

We could include a warning, saying that the AS should check that it is indeed the same user, typically through validating the sub_id

Please make it normative.